1. Field of the Invention
Embodiments of the invention relate to the field of network communication, and more specifically, to anti-replay protection.
2. Description of Related Art
Internet Protocol (IP) Security (IPSec) anti-replay protection is a security service in which the receiver may reject old or duplicate packets to protect itself against replay attacks. IPSec anti-replay works by having the sender apply a unique sequence number to the IPSec header for all encrypted packets within an IPSec Security Association (SA). The receiver checks off the sequence numbers of the packets it has seen. The sender assigns sequence numbers in an increasing order. The receiver remembers the value X of the highest sequence number that it has already seen. N is the window size and the receiver also remembers whether it has seen packets having sequence numbers from X-N+1 through X. Any received packets with sequence numbers that have already been seen are discarded In addition, any received packet with sequence number X-N (or less) is discarded.
At times, however, this sliding window based anti-replay protection mechanism causes good packets to be discarded. For example, Quality of Services (QoS) queues, at various network elements, allow newer real-time packets to pass older non-real-time packets, causing mis-ordering of packets within an IPSec SA and causing the anti-replay mechanism to discard good, older non-real-time packets, since they are received late.